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Claims 

1. A method for removing computer viruses comprising the steps of: 

(A) if a function to be used to search information about areas 
infectable by viruses has been changed, restoring the function to be in a 

5 normal state thereof; and 

(B) carrying out a procedure for scanning of infection and a 
disinfection procedure for processes residing in a memory and associated files 
scanned using a normal function. 

2. The method according to claim 1, wherein the normal function at 
10 the step (B) is the function determined to be unchanged, or restored using a 

previously-stored function when the function is determined to be changed. 

3. The method according to claim 1, wherein the step (B) comprises 
the steps of: 

scanning a process residing in the memory; 
15 determining whether or not the infected process is disinfectable, and 

disinfecting the process when it is determined that the infected process is 
disinfectable, while killing the process when it is determined that the infected 
process cannot be disinfected; and 

searching for a file associated with the infected process, and scanning 
20 and disinfecting the searched file. 

4. The method according to claim 1, wherein the procedure for 
scanning of infection and the disinfection procedure are further carried out for 
thread areas of the memory. 

5. The method according to claim 4, wherein the step (B) comprises 
25 the steps of: 

scanning a process residing in the memory; 

determining whether or not the infected process is disinfectable, and 
disinfecting the process when it is determined that the infected process is 
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disinfectable, while killing the process when it is determined that the infected 
process cannot be disinfected; 

searching for a file associated with, the process, and scanning and 
disinfecting the searched file; and 
5 scanning and disinfecting the thread areas of the memory. 

6. The method according to claim 4, wherein the step (B) comprises 
the steps of: 

scanning and disinfecting the thread areas of the memory; 
scanning a process residing in the memory; 
10 determining whether or not the infected process is disinfectable, and 

disinfecting the process when it is determined that the infected process is 
disinfectable, while killing the process when it is determined that the infected 
process cannot be disinfected; and 

searching for a file associated with the process, and scanning and 
15 disinfecting the searched file. 

7. The method according to claim 1, wherein the function is provided 
by DOS, Macintosh, Windows, OS/2, Unix, or Linux. 

8. The method according to claim 1, wherein the function is an 
application program interface (API) function or a system call. 

20 

9. A computer-readable storage medium recorded with a program for 
executing the steps of: 

(A) if a function to be used to search information about areas 
injectable by viruses has been changed, restoring the function to be in a 

25 normal state thereof; and 

(B) carrying out a procedure for scanning of infection and a 
disinfection procedure for processes residing in a memory and associated files 
scanned using a normal function. 

10. The computer-readable storage medium according to claim 9, 
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wherein the normal function at the step (B) is the function determined to be 
unchanged, or restored using a previously-stored function when the function 
is determined to be changed. 

11. The computer-readable storage medium according to claim 9, 
5 wherein the step (B) comprises the steps of: 

scanning a process residing in the memory; 

determining whether or not the infected process is disinfectable, and 
disinfecting the process when it is determined that the infected process is 
disinfectable, while killing the process when it is determined that the process 
10 cannot be disinfected; and 

searching for a file associated with the infected process, and scanning 
and disinfecting the searched file. 

12. The computer-readable storage medium according to claim 9, 
wherein the procedure for scanning of infection and the disinfection 

1 5 procedure are further carried out for thread areas of the memory. 

13. The computer-readable storage medium according to claim 12, 
wherein the step (B) comprises the steps of: 

scanning a process residing in the memory; 

determining whether or not the infected process is disinfectable, and 
20 disinfecting the process when it is determined that the infected process is 
disinfectable, while killing the process when it is determined that the infected 
process cannot be disinfected; 

searching for a file associated with the infected process, and scanning 
and disinfecting the searched file; and 
25 scanning and disinfecting the thread areas of the memory. 

14. The computer-readable storage medium according to claim 12, 
wherein the step (B) comprises the steps of: 

scanning and disinfecting the thread areas of the memory; 
scanning a process residing in the memory; 
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determining whether or not the infected process is disinfectable, and 
disinfecting the process when it is determined that the infected process is 
disinfectable, while killing the process when it is determined that the infected 
process cannot be disinfected; and 
5 searching for a file associated with the process, and scanning and 

disinfecting the searched file. 

15. The computer-readable storage medium according to claim 9, 
wherein the function is an application program interface (API) function or a 
system call. 

10 16. A virus-removing apparatus comprising: 

restoring means for restoring a function to be used to search 
information about areas infectable by viruses when the function has been 
changed; 

process disinfecting means for searching for a list of processes 
15 residing in a memory by use of the function in a normal state, and an entry 
point of each of the process, scanning a memory page, starting from the entry 
point of an associated one of the processes, thereby checking whether or not 
the associated process is infected by viruses, the process disinfecting means 
carrying out a procedure for disinfecting the associated process when the 
20 associated process has been infected; and 

file disinfecting means for searching for a file associated with each of 
the infected processes, scanning and disinfecting the searched file. 

17. The virus-removing apparatus according to claim 16, further 
comprising: 

25 thread disinfecting means for scanning and disinfecting thread areas 

of the memory. 

18. The virus-removing apparatus according to claim 16, wherein the 
function is provided by DOS, Macintosh, Windows, OS/2, Unix, or Linux. 
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19. The virus-removing apparatus according to claim 16, wherein the 
function is an application program interface (API) function or a system call. 

20. The virus-removing apparatus according to claim 16, wherein the 
virus-removing apparatus is a hardware device applied to a personal computer 

5 (PC), a personal digital 'assistant (PDA), a mobile phone, and industrial 
equipment including semiconductor manufacturing equipment. 



